Chapter 9 — Evidence and measurement
Lesson map
Lesson 09 published. Map, example, EX025.
flowchart TD
N0["Learning outcomes"]
N1["9.1 Evidence log"]
N2["9.2 Checking freshness"]
N3["Lab — Checking evidence freshness"]
N4["9.3 Reporting"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX025"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["9.1 Evidence log"]
N2["9.2 Checking freshness"]
N3["Lab — Checking evidence freshness"]
N4["9.3 Reporting"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX025"]
[Learning outcomes]
|
v
[9.1 Evidence log]
|
v
[9.2 Checking freshness]
|
v
[Lab — Checking evidence freshness]
|
v
[9.3 Reporting]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX025]
Learning outcomes
You will (1) keep an evidence log for controls; (2) check evidence freshness; (3) report stale evidence.
9.1 Evidence log
Riverton collects evidence that controls work: backup restore tests, access reviews, firewall reviews, policy acknowledgements, supplier assurance reports and encryption reports. Priya builds a log recording each item, its date and the maximum age allowed before it must be refreshed. She learns that evidence has a shelf life: a backup test from last year says little about whether backups work today, so freshness rules matter as much as the evidence itself. Each item's maximum age becomes the rule applied in the freshness check that follows.
9.2 Checking freshness
The lab checks six items against their limits on the last day of September. Three are stale. The second-quarter access review is ninety-four days old against a ninety-day limit. The firewall rule review is two hundred and thirty-two days old against one hundred and eighty. The supplier SOC 2 report is four hundred and fifty-seven days old against a year. The backup test, policy acknowledgements and encryption report are fresh. Priya notes that the access review is only slightly late. Four days over ninety needs a reminder, while the SOC 2 report at four hundred and fifty-seven days needs escalation.
Lab — Checking evidence freshness
"""Evidence freshness: items older than their allowed age (synthetic Riverton evidence log)."""
from datetime import date
today = date(2026, 9, 30)
log = [("backup restore test", date(2026, 7, 2), 90), ("access review Q2", date(2026, 6, 28), 90),
("firewall rule review", date(2026, 2, 10), 180), ("policy acknowledgement", date(2025, 11, 1), 365),
("vendor SOC 2 report", date(2025, 6, 30), 365), ("encryption report", date(2026, 9, 15), 30)]
stale = [(n, (today - d).days, m) for n, d, m in log if (today - d).days > m]
for n, age, m in stale: print(f"STALE {n}: {age} days old, limit {m}")
print(f"items {len(log)}; stale {len(stale)}; fresh {len(log) - len(stale)}")
Run with python3 lab_fresh.py. Verified output:
STALE access review Q2: 94 days old, limit 90
STALE firewall rule review: 232 days old, limit 180
STALE vendor SOC 2 report: 457 days old, limit 365
items 6; stale 3; fresh 3
9.3 Reporting
Priya reports stale items with their owners and how overdue each is. She treats the supplier report as most serious because it concerns the practice system provider, which holds all patient records. She requests the latest report from the provider. She learns that measuring evidence freshness turns an assurance file into a living control, and that small delays deserve a reminder while long gaps need escalation. Asking the provider for the latest report also tests whether the contract gives Riverton the right to receive it.
Worked example
Priya builds an evidence log with freshness limits, finds three stale items and escalates the old supplier report.
Synthetic case. Evidence items are synthetic.
Errors and limits
Fresh evidence can still be weak. Limits are judgement calls.
Exercises
- EX025 — Shelf life. Why does evidence have a shelf life? Rubric: 3 = old tests say little about current control operation;; 2 = freshness;; 1 = vague;; 0 = none.
- EX026 — Stale count. How many of six items were stale? Rubric: 3 = three;; 2 = 3;; 1 = vague;; 0 = none.
- EX027 — Most serious. Which stale item was most serious and why? Rubric: 3 = the supplier SOC 2 report, as the provider holds all patient records;; 2 = supplier;; 1 = access review;; 0 = none.
Synthesis
Evidence freshness rules keep assurance current and highlight what needs refreshing.
Continue studying — chapter 09 of 30
← Chapter 08 (draft) · Course chapter index · Chapter 10 (draft) →